An Architectural Foundation for Security Model Sharing and Reuse

Abstract

Within the field of software security we have yet to find efficient ways on how to learn from past mistakes and integrate security as a natural part of software development. This situation can be improved by using an online repository, the SHIELDS SVRS, that facilitates fast and easy interchange of security artefacts between security experts, software developers and their assisting tools. Such security artefacts are embedded in or represented as security models containing the needed information to detect, remove and prevent vulnerabilities in software, independent of the applied development process. The purpose of this paper is to explain the main reference architecture description of the repository and the more general tool stereotypes that can communicate with it.

Reusable Security Requirements for Healthcare Applications

“…Concerning the first point, an approach using a security repository concept such as those presented by Meland et al [11] and Ardi et al [25] allows security experts together with legal professionals to share the results of the complex requirements elicitation process. To include a feedback system in such repositories will allow both developers and other security experts to review the requirements, and constantly improve the repository content.…”

“…Security repositories containing requirements have been suggested by among others Sindre et al [8] and Toval et al [10]. Meland et al [11] have, in the SHIELDS project 2 , defined an architecture for a repository that together with other software security artefacts can contain a security requirements catalogue.…”

Analyzing Privacy Implications and Security Vulnerabilities in Single Sign-On Systems: A Case Study on OpenID Connect

“…This study in [14] investigates the privacy aspects of attribute sharing in Single Sign-On (SSO) solutions. The researchers examine the process of attribute sharing among multiple service providers in SSO systems and analyze the privacy risks associated with this sharing.…”

Vulnerability and Risk Analysis Methods and Application in Large Scale Development of Secure Systems

“…The SHIELDS EU project [63] has developed the SHIELDS internet-based Security Vulnerabilities Repository Service (SVRS) which is a VAD to support S3P and other applications [55], [56]. The GOAT tool is compatible with the SVRS and interfaces with it.…”